Help with InCommon and National Student Clearing House

Peter Schober peter.schober at
Wed Sep 28 16:33:16 UTC 2022

* Wessel, Keith via users <users at> [2022-09-28 18:21]:
> Deny rules are evaluated before permit rules and will thus cancel
> out any automatic releases from permits.

Not literally "before" as the attribute filter doesn't do "first (or
last) match wins" -- it evaluates and applies /all/ matching
policies. It's just that "deny" always wins over "permit" which is the
sane choice given overlapping and contradictory policies.


More information about the users mailing list